- Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of their users for six months, regardless of whether they have any criminal implications.
- Both Signal and Windscribe have indicated that they would rather abandon the Canadian market than comply, as they believe that the adoption of the Bill would violate their commitment to privacy and security.
- The Bill is currently before the Senate committee, the last chance to amend it before it becomes law.
The government of Canada is promoting a new legislation that would require telecommunication firms and messaging applications to store consumer information. The legislation, named Bill C-22, requires them to maintain six months of metadata related to each citizen. It is applicable to all people, irrespective of whether they are suspected of any crime.
The legislation has successfully passed the House of Commons. It now sits with a Senate committee, which is the last place lawmakers can change it. Tech companies are warning they may leave Canada if the bill becomes law.
What the Bill Requires
Bill C-22 would force electronic service providers to collect and keep metadata for six months. Metadata includes information about who people contact and where they are located. It does not include the content of messages, but it can reveal a lot about the life of a person.
The bill gives the Minister of Public Safety power to decide which companies must comply. It also lets the minister issue secret orders to individual providers. Also, it states that companies that disobey these orders will face fines of up to $250,000 per day.
A key concern is the timeline. The first regulations may take up to two years after the bill becomes law. Some officials suggest the full rules could take five years. This means the Senate must approve a surveillance system without knowing who will be covered or what data will be kept.
The bill also creates a new power for police to demand subscriber information. This power takes effect just 180 days after the bill passes, without waiting for regulations. As a result, police can have access to basic user information before the implementation of the broader data collection plans.
Tech Companies Threaten to Leave
Signal, an encrypted messaging service, says the company would prefer to stop its operations in Canada rather than comply with the proposed data retention rules. Signal believes that it has to break its commitment to privacy by processing user metadata. Signal keeps almost no user data, and adding a six-month store would force it to change its product fundamentally.
Windscribe, a Toronto-based VPN provider, is also preparing to move. Its CEO said the bill would make it impossible to keep the company’s privacy policy. Windscribe promises users it does not collect data about them.
The companies argue that forcing them to store data would create new security risks. A store of user information would become a target for hackers. Signal and Windscribe both say they cannot operate under these rules.
The Information Technology Innovation Foundation, a non-profit and non-partisan public policy organization, has raised concerns regarding the situation. It claims that the bill gives too much power to law enforcement agencies.
Also, other groups such as the Canadian Civil Liberties Association support the same notion about the bill. Thus, they highlight that the bill endangers encryption and forces many companies to comply with laws that would apply across other sectors.
The Debate Over Safety and Privacy
The government says the bill helps police and security agencies fight crime. Public Safety Canada argues that criminals and terrorists use modern apps to plan attacks. The bill would require companies to help law enforcement obtain information they already have legal back-up requests.
Critics say the bill goes too far. The Electronic Frontier Foundation warns that the bill could weaken encryption. It also says the bill would allow secret orders that companies cannot disclose. Privacy experts argue that the government has not shown why such broad data retention is needed.
Major technology companies, including Apple and Meta, have also raised privacy concerns over Bill C-22, alongside civil liberties groups. The Barreau du Québec, a legal association, has also raised concerns. The group noted that the bill lowers the legal threshold for police to access personal information. It argues that this lower standard may not meet constitutional privacy requirements.
The fate of the bill now rests with the Senate, so senators can propose amendments, but time is short. The government wants the law passed soon. Tech companies and privacy groups are pressing for changes before it is too late.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Hacker Claims Nearly 208,000 OpenRouter API Keys Are for Sale
A malicious individual has announced he is selling an OpenRouter database containing nearly 250,000 ...
Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware
Researchers found a campaign called DeadTag that abuses abandoned ad and analytics domains to send v...
PHP Warns of New Potential RCE Flaw, Recommends Disabling Upload Progress
PHP has disclosed CVE-2026-115560, a possible remote code execution flaw that affects apps with an u...
Google and Other Tech Giants Block eMudhra Certificates After Weak Keys Exposed
Researchers cracked eight very weak secret keys tied to Indian certificate company eMudhra within se...
Microsoft Admits Windows 11 October Updates Failed to Fix Always On VPN Bug
Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug. The...
Canva Confirms Salesforce Data Exposure via Canny as Hackers Claim Millions of Records
Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business c...
